{"id":58582,"date":"2025-04-29T22:06:54","date_gmt":"2025-04-29T22:06:54","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/watch-out-for-any-linux-malware-sneakily-evading-syscall-watching-antivirus\/"},"modified":"2025-04-29T22:06:54","modified_gmt":"2025-04-29T22:06:54","slug":"watch-out-for-any-linux-malware-sneakily-evading-syscall-watching-antivirus","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/watch-out-for-any-linux-malware-sneakily-evading-syscall-watching-antivirus\/","title":{"rendered":"Watch out for any Linux malware sneakily evading syscall-watching antivirus"},"content":{"rendered":"

A proof-of-concept program has been released to demonstrate a so-called monitoring “blind spot” in how some Linux antivirus and other endpoint protection tools use the kernel’s io_uring interface.<\/p>\n

That interface<\/a> allows applications to make IO requests without using traditional system calls. That’s a problem for security tools that rely on syscall monitoring to detect threats.<\/p>\n

Rather than making a system call for each request, these operations \u2013 such as reading and writing files \u2013 are queued in ring buffers that the kernel rattles through and returns the results in separate buffers. Antivirus that watches syscalls for malicious activity may miss changes that are instead going through the io_uring queues.<\/p>\n